BSA/AML/CFT Compliance

Topic

Examples

BSA/AML Compliance Program

• Establish, implement and maintain a BSA/AML compliance program designed to comply with the BSA and its implementing regulations.
• Conduct effective risk assessments, tailored to the financial institution’s business activities.

Controls

• Design, implement, and maintain a system of internal controls.
• Identify and timely address significant/systemic internal control gaps, including weaknesses in transaction monitoring, fraud referral processes, third-party risk assessment, and financial crimes risk management.
• Establish effective transaction monitoring controls, including the configuration and supervision of surveillance tools and data governance practices or to timely correct known deficiencies.  

Due Diligence

• Establish and maintain an effective framework to conduct ongoing customer due diligence and customer identification program procedures, including to update customer information on a risk basis (e.g., sanctions evasion risks).
• Conduct due diligence for correspondent accounts for foreign financial institutions.

Suspicious Activity

• Identify, evaluate, and report suspicious activity on a timely basis (e.g., missed, late, inaccurate, and incomplete suspicious activity reports (SARs)).
• Monitor large volumes of transactions, including those of “high-risk” customers.

Sanctions

• Mitigate and report priority national security risks related to money laundering and illicit finance.
• Update watchlists following OFAC designations.

Independent Testing

• Establish effective independent testing (e.g., internal audit) to monitor the financial institution’s compliance with BSA/AML regulatory requirements.

Resources

• Adequately staff and provide appropriate risk-based BSA/AML training, commensurate with an employee’s job-specific responsibilities and duties.

Topic

Action

Board Oversight and Governance

Require boards to enhance oversight of BSA/AML remediation efforts, including efforts to:

• Hold management accountable for executing effective remediation plans, including to implement and maintain effective BSA/AML compliance programs.
• Ensure adequate staffing and resources.
• Receive timely reporting regarding compliance risks, deficiencies, and remediation progress.

Risk Assessment Programs

• Submit a written plan to improve BSA/AML compliance programs, which include written policies, standards, and procedures.
• Develop or enhance institution-wide BSA/AML risk assessment processes that evaluate products, services, customer types, transactions activity, geographies, delivery channels, and other financial crime risks.
• Risk assessment frameworks should be periodically refreshed and supported by effective management reporting and governance.

Customer Due Diligence

• Implement risk-based customer due diligence and customer identification programs designed to appropriately understand the nature and purpose of customer relationships, assign (and revise) risk ratings, conduct ongoing monitoring, collect required information, and escalate higher-risk customer activity.

Suspicious Activity Monitoring and Reporting

• Develop, implement, and adhere to a risk-based suspicious activity identification, evaluation, and reporting program.
• Enhance suspicious activity monitoring systems, thresholds, models, escalation processes, and SAR investigation procedures to ensure suspicious activity is identified, investigated, and reported accurately and timely across business lines.

Sanctions Compliance

• Develop and maintain a documented methodology for assessing OFAC risks, provide ongoing, periodic training tailored to an employee's job responsibilities, and enhance sanctions policies and procedures, including OFAC screening procedures.

Independent Testing and Internal Audit

• Conduct independent testing and audit programs to evaluate the adequacy of BSA/AML policies, procedures, internal controls, monitoring systems, training, and suspicious activity reporting processes.

Independent Consultant and Lookback Reviews

Retain qualified independent third parties to:

• Evaluate BSA/AML transaction monitoring programs.
• Conduct root-cause analyses.
• Assess corrective actions, recommend control enhancements and/or program redesign.
• Perform data testing, including data lineage, data quality, mapping and governance controls.
• Conduct historical lookback reviews to determine whether suspicious activity should have been identified, investigated, or reported. 

Staffing and Training

• Conduct staffing assessments and provide sufficient personnel, expertise, training, and resources to support BSA/AML compliance obligations. Training programs should be tailored to employees' specific responsibilities and financial crime risks.

Employee Accountability

• Establish processes to identify, investigate, and address employee misconduct contributing to BSA/AML compliance failures and implement appropriate governance surrounding disciplinary actions and accountability measures.

Progress Reporting and Regulatory Communication

• Provide periodic progress reports to regulators detailing remediation activities, implementation milestones, corrective actions, and compliance status.